[coreyphillips]

Closes #189

The Boltz swap service has shut down, so the boltz module can no longer complete a swap. This removes it from bitkit-core, along with everything that existed only to serve it.

What changed

• Deleted src/modules/boltz/ (14 files) and its pub mod boltz; in src/modules/mod.rs.
• src/lib.rs: removed the Boltz imports, the boltz_swaps re-export, the boltz_db field on AsyncDatabaseConnections, the Boltz lines in init_db, and the whole Boltz swaps section with its 11 #[uniffi::export] functions. AsyncDatabaseConnections stays, holding only blocktank_db.
• src/modules/activity/types.rs: removed the BoltzError import, the DbError::DbBoltzError variant and impl From<BoltzError> for DbError.
• Cargo.toml no longer depends on boltz-client. Cargo.lock drops it and the transitive crates only it used. That includes lightning 0.2.8, lightning-invoice 0.34.2 and lightning-types 0.3.5, which chore: prepare 0.8.0-rc15 #207 updated. The scanner's lightning-invoice 0.32.0 and lightning-types 0.1.0 stay.
• Regenerated bindings/ios/bitkitcore.swift and bindings/ios/bitkitcoreFFI.h. Package.swift is unchanged.
• Removed boltz from the module lists in AGENTS.md (CLAUDE.md is a symlink to it).
• Added an Unreleased entry to CHANGELOG.md, and removed the "Update lightning to 0.2.8" line from chore: prepare 0.8.0-rc15 #207, since lightning is no longer a dependency. The 0.5.x Boltz entries are left as they were.

Breaking for consumers

• Every boltz* function and the Boltz types are gone: BoltzNetwork, BoltzSwapType, BoltzSwapStatus, BoltzPairInfo, SubmarineSwapResponse, ReverseSwapResponse, BoltzSwap, BoltzSwapEvent, BoltzError and BoltzEventListener.
• Removing DbError.DbBoltzError breaks exhaustive Swift switch and Kotlin when statements over DbError at compile time.

boltz.db on existing installs

init_db no longer creates or opens boltz.db, and it leaves an existing one on disk untouched. That file holds each swap's swap_index and create_response_json. With the wallet seed, that is what a manual refund of a locked submarine swap would need, so it is not deleted. The new tests/init_db.rs checks both cases: a fresh directory gets no boltz.db, and an existing one keeps its exact bytes. The test lives outside src so the crate itself keeps no reference to the removed module.

Not in this change

• Deleting boltz.db from existing installs.
• origin/feat/pubky-swap-boltz builds on Boltz and will need to be rebased or closed separately. feat/pubky-swaps-route merged as feat: pubky swaps as paykit route #182 and doesn't use Boltz.
• Version bump and release.

How to test

• Rebased onto 2210649, after chore: prepare 0.8.0-rc15 #207. cargo test -- --skip modules::blocktank::tests: 726 unit tests passed (30 ignored), and tests/init_db.rs passed.
• The Blocktank tests call live services. Run at the earlier base 8fbf1d7, 40 of 48 pass and 8 fail there: staging answers order creation with 404, and the regtest API returns 401 Unauthorized. They don't touch this change, and CI doesn't run them.
• cargo clippy --all-targets reports no errors. None of its warnings are on a line this change touched. The 5 in src/lib.rs are at lines 52, 268, 1245, 1450 and 1503, in code this change leaves alone.
• grep -rni boltz src Cargo.toml bindings CLAUDE.md AGENTS.md finds only two comments in pubky_swaps (keys.rs, README.md) saying its keys can't collide with the old Boltz BIP85 keys, which still holds for seeds that made Boltz swaps. tests/init_db.rs mentions it on purpose.
• Cargo.lock has no boltz-client or boltz-client-macros entry, and cargo metadata --locked --format-version 1 succeeds.
• The iOS bindings were regenerated after the rebase from the release library, the way build_ios.sh runs uniffi-bindgen, and match the committed files byte for byte. They contain no Boltz symbols.

[talosmachina]

No findings. Removes the Boltz swap module, its 11 UniFFI exports, the DbError.DbBoltzError case and the boltz-client dependency, and stops init_db from opening boltz.db. Reviewed 39ee908, full tier, static: the PR's code was not built or run here (the build gate could not read the author's permission and fails closed).

What I checked, and 5 candidates I ruled out

Read in full: the src/lib.rs, src/modules/activity/types.rs, src/modules/mod.rs, Cargo.toml, AGENTS.md, CHANGELOG.md diffs, tests/init_db.rs, init_db as it stands at the head.
Bindings compared against the merge base: bitkitcoreFFI.h and bitkitcore.swift.
CI: SwiftPM manifest, manifest checks and wake-tests green; iOS Bindgen, Android Bindgen and usdt-tests still queued when this was written.

Ruled out

• Leftover references: git grep -i boltz at the head hits only CHANGELOG.md and tests/init_db.rs, both on purpose.
• Bindings drift beyond Boltz: the header loses exactly the 11 boltz_* functions and gains none; the Swift file loses exactly the Boltz types and their converters and gains none. The checksums for the other 220 exported functions match the base byte for byte, and the large + hunks are git realigning unchanged types such as ChannelLiquidityOptions, which is already at the base.
• DbError discriminants: UniFFI lifts errors by index; the Swift DbError converter is regenerated with DbBlocktankError at 2 and InitializationError at 3, consistent with the Rust enum, so the generated side reads correctly. The source break for exhaustive matches is stated in the body and the changelog.
• Cargo.lock: the + lines are disambiguated names (sha3 0.11.0 to sha3 and similar) that become unique once boltz-client's transitive copies leave, plus lightning-types moving within a dependency list; no new crate or version enters.
• init_db with the field gone: AsyncDatabaseConnections still initialises blocktank_db, and Arc is still used by onchain_start_watcher, so no unused import.

Merge confidence: 4/5, no findings, but I did not build it and iOS Bindgen, the check that proves the committed bindings match the code, had not run yet.

[coreyphillips]

Reviewed, nothing blocking a merge.

Acceptance criteria as the review ruled them. Nothing was ticked on the issue:

• Met: src/modules/boltz/ no longer exists, and src/modules/mod.rs does not declare it. Confirmed the module directory and its declaration are removed.
• Met: grep -rni boltz src Cargo.toml bindings CLAUDE.md AGENTS.md returns nothing. The required recursive search returned no matches.
• Met: Cargo.lock has no boltz-client or boltz-client-macros entries, and cargo metadata --locked --format-version 1 succeeds. Neither package remains in Cargo.lock, and cargo metadata --locked --format-version 1 succeeded.
• Met: DbError has no DbBoltzError variant, and no From<BoltzError> impl remains. Confirmed removal of the DbBoltzError variant and From implementation.
• Met: init_db creates only activity.db and blocktank.db. An existing boltz.db in base_path is left untouched, and init_db still succeeds. Rust and Swift tests confirmed creation of only activity.db and blocktank.db. Existing boltz.db bytes were preserved.
• Met: The committed bindings/ios/bitkitcore.swift and bitkitcoreFFI.h match a fresh ./build_ios.sh run and contain no Boltz symbols. A fresh build_ios.sh run in a temporary snapshot matched all three committed interface files byte for byte, with no Boltz symbols.
• Met: CHANGELOG.md has an Unreleased entry covering the removal and the DbError source break. Unreleased covers the removal and the exhaustive Swift/Kotlin DbError source break.
• Not met: cargo build, cargo clippy and cargo test pass with no new warnings. Build and clippy passed with existing warnings. Tests had 603 unit passes and 107 socket/DNS failures. The database integration test passed.

[ovi-reviewer]

Verdict: ⚠️ Not verified — live Blocktank checks cannot reach staging.

Findings: None.

QA for 39ee908:

Check: Build the remaining library ✅ cargo build --locked succeeds.

Checked by compiling the library at this head.

Check: Lint the remaining library and tests ✅ Clippy succeeds with no warnings on changed lines.

Checked with cargo clippy --locked --all-targets; the warnings refer to unchanged code.

Run the remaining Rust tests ⏭️ Live Blocktank checks could not be verified because staging requests fail.

The tests that call api.stag.blocktank.to fail while sending requests; a direct HTTPS connectivity check also times out. All other executed Rust tests passed. These results leave live Blocktank behavior unverified.

Initialize databases without touching saved swaps ✅ The database preservation integration test passes.

Checked with cargo test --locked --test init_db: initialization creates activity.db and blocktank.db, creates no boltz.db, and preserves the exact bytes of an existing boltz.db.

Check: Match the generated iOS interface ✅ Same-head CI confirms the committed interfaces match regeneration.

The iOS Bindgen run passes generation, the committed-interface comparison, and the Swift smoke test. The existing report also confirms Rust and Swift database initialization at this head. The Android Bindgen run passes.

Check: Remove only the retired swap surface ✅ The exported surface and dependency comparison is consistent.

Checked against the PR's branch point: the removed functions are the 11 Boltz functions, the other exported function checksums are unchanged, no package version is added, and cargo metadata --locked --format-version 1 succeeds.

Full review of the 24-file diff. Device tests were not run: this library removal specifies Rust and binding checks, with no app journey. No device case exercised the removed APIs or either consumer app. The earlier static review covers the same head.

---

Reviewed by gpt-6.1-sol-high

[talosmachina]

No findings. Re-review at 4817251, which is the same change rebased onto current master (now carrying pubky_swaps, wake and the regtest auth work). Static: the PR's code was not built or run here, because the build gate could not read the author's permission and fails closed. CI at this head is green on every job, including iOS Bindgen and Android Bindgen.

What I checked since 39ee908

The rebase against pubky_swaps: the module merged in #182 does not import modules::boltz or the boltz-client crate (git grep boltz_client at master outside src/modules/boltz finds nothing). It has its own pubky_swaps::init in init_db, which this PR keeps, and tests/init_db.rs does not assert anything about the pubky_swaps/ directory that call creates.

src/lib.rs, activity/types.rs, modules/mod.rs, Cargo.toml, AGENTS.md: diffed against the new merge base 8fbf1d7. Same removals as before: AsyncDatabaseConnections keeps only blocktank_db, and DbError loses DbBoltzError and its From impl.

Bindings: compared with the merge base, bitkitcoreFFI.h loses only the 11 boltz_* functions and their checksums, and adds nothing. The checksum of every other exported function in bitkitcore.swift is unchanged, the pubky_swaps and wake surface is still present, and the Swift DbError converter reads DbBlocktankError at 2 and InitializationError at 3.

Cargo.lock: 34 packages go (among them boltz-client, boltz-client-macros, elements, secp256k1-zkp, lightning 0.2.3, tungstenite) and none come in.

Earlier review: it had no findings to recheck. It held back on iOS Bindgen not having run yet, and that check now passes at this head.

One stale line in the body: grep -rni boltz src no longer returns nothing. After the rebase it hits src/modules/pubky_swaps/keys.rs:6 and src/modules/pubky_swaps/README.md:69, two comments saying the swap keys cannot collide with the Boltz module's BIP85 keys. That still holds for seeds that made Boltz swaps, so the code needs no change. Only the body's claim is out of date.

Merge confidence: 5/5. It is a pure removal with no findings, the source break for consumers is spelled out in the changelog, and the bindings check passes at this head. I did not build it myself.

[coreyphillips]

@ovitrif @ben-kaufman this is rebased onto current master with CI green, and talosmachina's re-review at 4817251 found nothing. Could one of you approve?

[ovi-reviewer]

Verdict: ⚠️ Not verified — live Blocktank checks still depend on unavailable staging operations.

Findings: None.

QA for 7aeca6b:

Check: Build the remaining library ✅ cargo build --locked succeeds.

Checked by compiling the library at this head.

Check: Lint the remaining library and tests ✅ Clippy succeeds; no warning points to a changed line.

Checked with cargo clippy --locked --all-targets and compared warning locations with the diff.

Run Rust tests outside unavailable staging operations ✅ All remaining default unit tests passed.

Checked with cargo test --locked -- --test-threads=8. The only failures were the live Blocktank setup errors reported separately below; tests already marked ignored were not enabled.

Exercise live Blocktank operations ⏭️ Staging prevents verification of order, CJIT and regtest operations.

The Rust run retried the previously unverified cases. Order and CJIT creation return HTTP 404; mining and deposit return 401 Unauthorized without staging authentication. The affected test and API files are unchanged from the base. These are setup errors, so live behavior remains unverified.

Initialize databases without touching saved swaps ✅ The preservation integration test passes.

Checked with cargo test --locked --test init_db: fresh initialization creates activity.db and blocktank.db without creating boltz.db, and initializing over an existing boltz.db preserves its exact bytes.

Check: Match the generated mobile interfaces ✅ Same-head CI passes iOS regeneration and interface comparison, Android generation, and both binding smoke tests.

The iOS Bindgen run runs build_ios.sh, compares all committed interface files and executes the Swift smoke test. The Android Bindgen run generates the bindings and native libraries and compiles the Kotlin smoke fixture.

Check: Remove only the retired swap surface ✅ The retained export checksums and package versions match the base.

Checked the generated header and Swift checksum tables against the current base: only Boltz functions and listener support disappear. The lockfile adds no package or version. cargo metadata --locked --format-version 1 also succeeds.

Full re-review of the 24-file diff after the rebase replaced the previously reviewed head. Device tests were not run: the PR specifies library and binding checks, with no app journey. No device case exercised the removed APIs or either consumer app.

---

Reviewed by gpt-6.1-sol-high